Three layers
Security opens the account.Sovereignty and longevity sit underneath.
Agent 365 would hold the record inside Microsoft.
Permissions, curated knowledge, policies, and sessions stay in your tenant.
01 · Security
Contested
Discovery · Policy · Record
02 · Sovereignty
Tenant-resident
Permissions · Knowledge · Sessions
03 · Longevity
HITL · Rewind
Lasting knowledge · policies · sessions
Pressure is on the top band
Platform Architecture
Security
Layer 01Decide before the write.
The budget that exists today. Discover the agents, resolve identity and policy on the tool call, record the decision — before the write proceeds.
Layer 01 · Security
Discovery
Policy at execution
create_issue · AUTH-118
Allowed
git.push origin/main
Approval
Decision record
Maya Chen · on-call
approved · create_issue · AUTH-118
Sovereignty
Layer 02Untied from the tool.
Permissions, curated knowledge, policies, and sessions travel with the tenant. Switch the client or the workstream — the authority does not fork.
Layer 02 · Sovereignty
Vendor-neutral


Your tenant
Permissions, knowledge, sessions stay here
Longevity
Layer 03HITL. Rewind. Lasting knowledge.
Those portable policies, sessions, and curated knowledge last. Approve or refuse in the loop. Rewind a path back from the action.
Layer 03 · Longevity
Approved
create_issue · AUTH-118
Rejected
force-push main · blocked
Reversed
PR #1204 · rewind path

